Deep learning for credit controls

ABSTRACT

Systems and methods are provided to identify abnormal transaction activity by a participant that is inconsistent with current conditions. Historical participant and external data are identified. A recurrent neural network identifies patterns in the historical participant and external data. A new transaction by the participant is received. The new transaction is compared using the patterns to the historical participant and external data. An abnormality score is generated. An alert is generated if the abnormality score exceeds a threshold.

REFERENCE TO RELATED APPLICATIONS

This application is a continuation under 37 C.F.R. § 1.53(b) of U.S.patent application Ser. No. 15/467,632 filed Mar. 23, 2017, now U.S.Pat. No. ______, the entire disclosure of which is incorporated byreference herein.

BACKGROUND

A financial instrument trading system, such as a futures exchange,referred to herein also as an “Exchange”, such as the Chicago MercantileExchange Inc. (CME), provides a contract market where financialproducts/instruments, for example futures and options on futures, aretraded. Futures is a term used to designate all contracts for thepurchase or sale of financial instruments or physical commodities forfuture delivery or cash settlement on a commodity futures exchange. Afutures contract is a legally binding agreement to buy or sell acommodity at a specified price at a predetermined future time, referredto as the expiration date or expiration month. An option is the right,but not the obligation, to sell or buy the underlying instrument (inthis case, a futures contract) at a specified price within a specifiedtime. The commodity to be delivered in fulfillment of the contract, oralternatively, the commodity, or other instrument/asset, for which thecash market price shall determine the final settlement price of thefutures contract, is known as the contract's underlying reference or“underlier.” The terms and conditions of each futures contract arestandardized as to the specification of the contract's underlyingreference commodity, the quality of such commodity, quantity, deliverydate, and means of contract settlement. Cash Settlement is a method ofsettling a futures contract whereby the parties effect final settlementwhen the contract expires by paying/receiving the loss/gain related tothe contract in cash, rather than by effecting physical sale andpurchase of the underlying reference commodity at a price determined bythe futures contract price.

Typically, the Exchange provides for a centralized “clearing house”through which all trades made must be confirmed, matched, and settledeach day until offset or delivered. The clearing house is an adjunct tothe Exchange, and may be an operating division thereof, which isresponsible for settling trading accounts, clearing trades, collecting,and maintaining performance bond funds, regulating delivery, andreporting trading data. The essential role of the clearing house is tomitigate credit risk. Clearing is the procedure through which theClearing House becomes buyer to each seller of a futures contract, andseller to each buyer, also referred to as a novation, and assumesresponsibility for protecting buyers and sellers from financial loss dueto breach of contract, by assuring performance on each contract. Aclearing member is a firm qualified to clear trades through the ClearingHouse.

Credit risk may be managed by implementing pre-trade credit controls.Pre-trade credit controls may set pre-defined limits for parties that,if breached, prevent entry or execution of undesirable trades.Post-trade credit controls may additionally limit a party's activity torisk reducing trades if a customer's pre-defined credit limit has beenbreached. Both pre-and post-trade credit control options are inherentlyreactive in nature, waiting for a party to actually breach pre-definedlimits. As such, both types of credit controls rely on setting fixedlimits. However, such fixed limits do not detect or prevent undesirableactivity such as rapid oscillations between long and short positionswithin the risk limits set by the customer that may nevertheless resultsin large losses.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts an illustrative computer network system that may be usedto implement aspects of the disclosed embodiments.

FIG. 2 depicts an illustrative embodiment of a general computer systemfor use with the disclosed embodiments.

FIG. 3 depicts an illustrative example of an activity module of thecomputer network system of FIG. 1 .

FIG. 4 depicts an illustrative example of neural network.

FIG. 5 depicts an illustrative example of a recurrent autoencoder neuralnetwork.

FIG. 6 depicts an example flowchart indicating a method of implementingthe disclosed system for detecting abnormal activity by a participant ina data transaction processing system.

FIG. 7 depicts an example flowchart indicating a method of implementingthe disclosed system for detecting abnormal activity by a participant ina data transaction processing system.

FIG. 8 depicts an example flowchart indicating a method of implementingthe disclosed system for detecting abnormal activity by a participant ina data transaction processing system.

DETAILED DESCRIPTION

The disclosed embodiments relate generally to a system that analyzes andlearns a participant's historical transactional patterns and strategies,and proactively monitors if a participant's present transactionalactivity deviates therefrom in a manner inconsistent with currentexternal conditions so as to pose a risk to that participant.Embodiments provide a two-step process that includes training a modelwith historical transactional and external data and inputting currenttransactional data to detect abnormal activity.

To mitigate credit risk, an Exchange may attempt to identify abnormalactivity. In one example, the Exchange may provide a platform fortraders that provide passive liquidity. Passive liquidity providers mayoperate using algorithms that track the market and place respectiveorders. The actions of passive liquidity providers may magnify anyabnormal incidents. A credit risk management system may be used to trackhow often the liquidity providers place orders. However, due to themovement of pricing and valuation throughout a trading day, it is hardto discern which activity from the liquidity providers is detrimental.The sheer volume and execution rate of trading algorithms mean that whenissues occur, it may be too late for a firm to take corrective actionseven with a trading firm stop button in place to cancel all orders &quotes from or to an exchange.

In a simple system for monitoring credit of credit card users, issuersof credit have sought to limit fraud losses by attempting to detectfraudulent use before the cardholder has reported a lost or stolen card.One technique is known as parameter analysis. A parameter analysisdetermines fraud using a small number of database fields combined in asimple Boolean condition. An example of such a condition is: if (numberof transactions in 24 hours>X) and (more than Y dollars authorized) thenflag this account as high risk.

In more complex systems, fraud may be detected using predictivemodeling. A system may receive data that results from a transaction. Fora credit card fraud detection program, such data may include cardholderaccount information, merchant account information, and paymentinformation such as date, time, and amount. Data may be received fromboth genuine and fraudulent, approved, and unapproved transactions. Thedata may then be parsed to determine whether a transaction has a highrisk of being fraudulent. Each transaction is compared with acardholder's history or an acceptor history to determine whichtransactions appear abnormal. Qualities about a transaction such as theamount, date, time, and type (e.g., restaurant, online, etc.) may beconsidered when determining whether a transaction may be a fraudulenttransaction. Complex systems may use other types of analysis or modelingsuch as statistical analysis, decision trees, or data mining techniques.

Statistical analysis or decision trees identify statistical similarityquickly by employing linear mathematical models or simple conditionallogic but resulting in a much more fitted model that is often biased bythe magnitude of the inputs and fails quickly when a new characteristicappears in the data. Data mining techniques may be fast at identifyingthe probabilistic occurrence of a sequence of events with another. Thedata, if normalized well, may result in no bias to the magnitude of theinput. Data mining techniques may be able to learn in an unsupervisedmanner when compared to the statistical approach but are also limited inthe ability to handle the degree of variation in its input from what ithas seen in the past.

Advanced modeling systems may be used, such as regression analysis ordeep learning though neural networks. Regression analysis is astatistical process for estimating the relationships among variables.Regression analysis may be used to identify the strength of therelationship between two variables such as how the price of a contractis related to interest rates. Regression takes a group of randomvariables, thought to be predicting an outcome, and tries to find amathematical relationship between them. Regression analysis hasdrawbacks in that regression analysis is sensitive to outliers andoverfitting. Regression analysis further may not include an efficientfeedback loop and as such has difficulties adapting to new data.

Neural networks may be made up of a collection of interconnectedprocessing nodes. The connections between the nodes may be dynamicallyweighted. Neural networks employ a technique of learning relationshipsthrough repeated exposure to data and adjustment of internal weights.Neural networks allow quick model development and automated dataanalysis. Neural networks provide statistical modeling that is capableof building models from data containing both linear and non-linearrelationships. While similar in concept to regression analysis, neuralnetworks may capture nonlinearity and interactions among independentvariables without pre-specification. Whereas traditional regressionanalysis requires that nonlinearities and interactions be detected andspecified manually, neural networks perform these tasks automatically.

There are different types of neural networks. Two distinct types arefeedforward neural networks (FNN) and recurrent neural networks (RNN).Neural networks include input layers, hidden layers, and output layers.For a FNN, the information (data) proceeds from input to hidden tooutput in one direction. There are no loops or feedback in a feedforwardneural network. A drawback for a feedforward neural network is that afeedforward neural network lacks the temporal awareness, e.g., does notdiscover inter-relationships between adjacent inputs in a series ofinputs. In a trading example, it may be important to identify andunderstand the nearest historical events as the events may influence thecurrent activity. A feedforward network is agnostic to how event relateto one another.

A recurrent neural network includes cycles, e.g., computations derivedfrom earlier inputs are fed back into the network. The feedback or loopallows for a kind of memory in the network. As such, recurrent neuralnetworks are dynamic and include a state that changes continuously untilthe recurrent neural network reaches an equilibrium point. The recurrentneural network remains at the equilibrium point until the input changesand a new equilibrium is found.

In each of these previous systems, the only data used for the model isthe customer's data. The fraud predictive model and the credit riskmodel do not consider external factors. Both the simple system, complexsystem, and advanced system for credit risk monitoring lack externalfactors, e.g., all three systems include customer level data that isanalyzed to generate a model that predicts the risk of the customer'stransactions.

Embodiments herein, provide a recurrent neural network that makes use ofboth participant and external factors to identify activity that deviatesfrom prior activity and prior conditions. Activity that deviates fromprior activity may be activity that is quantifiably past a thresholddeviance from normal activity considering the current conditions. Forexample, in a standard distribution, activity that is beyond a standarddeviation taken in the context of externally influencing correlatedfactors. Embodiments generate a model of past activity and pastconditions that is then compared to current conditions to determine ifan activity is unexpected and how far outside the bounds of normalitythe activity is or how much risk the activity entails and whether therisk is appropriate given the circumstances.

Embodiments use a RNN architecture referred to as a recurrent(bottleneck) autoencoder. Using a recurrent autoencoder approach, thesystem encodes the input data and then reconstructs the data on theoutput side. The model is trained using historical participant andexternal factor data. Training the model reduces the error between theinput and reconstructed data set. A recurrent autoencoder identifiespatterns by first compressing (encoding) the input data and thendecompressing (decoding) to reconstruct the input data. Data with a highdegree of structure (as opposed to random data) provides for a highercompression ratio as the compressing encoder leverages the structure toreduce the compressed data size. The patterns or relationships that areidentified when training are used by the model to identify thesimilarity of new transactions to previous transactions, e.g. toidentify outlier transactions that may be unexpected given thetransaction data and external factors.

Embodiments provide a method by which the risk profile of a tradingentity and the factors that affect it such as the risk profile of thegeneral market at a given time T may be correlated by means of anon-linear representation network such as a RNN. Further the network maybe used in real time, inputting activity from the entity and theenvironment events to detect any anomalies in the activity that couldadversely affect the risk profile of the entity.

The disclosed embodiments may be implemented to increase the timing andefficiency in the computational system. Activity may be tracked by anactivity module. Risk may be assessed using a risk processor.Participant activity may be recorded and predicted, efficiently andaccurately without additional user input. The increased efficiency anddecreased usage of resources may lead to a less risky market, resultingin additional trading, fewer outlier events, and the ability to identifyand prohibit human or machine error.

One exemplary environment where detecting abnormal activity is desirableis in financial markets, and in particular, electronic financialexchanges, such as a futures exchange, such as the Chicago MercantileExchange Inc. (CME). In particular, an exchange may enable the profilingof a market participant using machine learning techniques, which whentrained in an unsupervised manner may identify the normal tradingpatterns for individual firms and participants. The model may classifysimilar data together and may learn to make predictions from the data.This may then be used to proactively monitoring the current tradingpatterns including both order flow and filled pattern of a firm andalert before hard coded limits are breached. With the order entryvolumes and execution speeds involved in the markets due to highfrequency and algorithmic traders, this approach may help detect whentrading algorithms are not functioning properly.

A financial instrument trading system, such as a futures exchange, suchas the Chicago Mercantile Exchange Inc. (CME), provides a contractmarket where financial instruments, e.g., futures and options onfutures, are traded using electronic systems. “Futures” is a term usedto designate all contracts for the purchase or sale of financialinstruments or physical commodities for future delivery or cashsettlement on a commodity futures exchange. A futures contract is alegally binding agreement to buy or sell a commodity at a specifiedprice at a predetermined future time. An option contract is the right,but not the obligation, to sell or buy the underlying instrument (inthis case, a futures contract) at a specified price within a specifiedtime. The commodity to be delivered in fulfillment of the contract, oralternatively the commodity for which the cash market price shalldetermine the final settlement price of the futures contract, is knownas the contract's underlying reference or “underlier.” The terms andconditions of each futures contract are standardized as to thespecification of the contract's underlying reference commodity, thequality of such commodity, quantity, delivery date, and means ofcontract settlement. Cash settlement is a method of settling a futurescontract whereby the parties effect final settlement when the contractexpires by paying/receiving the loss/gain related to the contract incash, rather than by effecting physical sale and purchase of theunderlying reference commodity at a price determined by the futurescontract, price. Options and futures may be based on more generalizedmarket indicators, such as stock indices, interest rates, futurescontracts, and other derivatives.

An exchange may provide for a centralized “clearing house” through whichtrades made must be confirmed, matched, and settled each day untiloffset or delivered. The clearing house may be an adjunct to anexchange, and may be an operating division of an exchange, which isresponsible for settling trading accounts, clearing trades, collecting,and maintaining performance bond funds, regulating delivery, andreporting trading data. One of the roles of the clearing house is tomitigate credit risk. Clearing is the procedure through which theclearing house becomes buyer to each seller of a futures contract, andseller to each buyer, also referred to as a novation, and assumesresponsibility for protecting buyers and sellers from financial loss dueto breach of contract, by assuring performance on each contract. Aclearing member is a firm qualified to clear trades through the clearinghouse.

The clearing house of an exchange clears, settles, and guaranteesmatched transactions in contracts occurring through the facilities ofthe exchange. In addition, the clearing house establishes and monitorsfinancial requirements for clearing members and conveys certain clearingprivileges in conjunction with the relevant exchange markets.

The clearing house establishes clearing level performance bonds(margins) for all products of the exchange and establishes minimumperformance bond requirements for customers of such products. Aperformance bond, also referred to as a margin requirement, correspondswith the funds that must be deposited by a customer with his or herbroker, by a broker with a clearing member or by a clearing member withthe clearing house, for the purpose of insuring the broker or clearinghouse against loss on open futures or options contracts. This is not apart payment on a purchase. The performance bond helps to ensure thefinancial integrity of brokers, clearing members and the exchange as awhole. The performance bond refers to the minimum dollar depositrequired by the clearing house from clearing members in accordance withtheir positions. Maintenance, or maintenance margin, refers to a sum,usually smaller than the initial performance bond, which must remain ondeposit in the customer's account for any position at all times. Theinitial margin is the total amount of margin per contract required bythe broker when a futures position is opened. A drop in funds below thislevel requires a deposit back to the initial margin levels, i.e., aperformance bond call. If a customer's equity in any futures positiondrops to or under the maintenance level because of adverse price action,the broker must issue a performance bond/margin call to restore thecustomer's equity. A performance bond call, also referred to as a margincall, is a demand for additional funds to bring the customer's accountback up to the initial performance bond level whenever adverse pricemovements cause the account to go below the maintenance.

The exchange derives its financial stability in large part by removingdebt obligations among market participants as the debt obligationsoccur. This is accomplished by determining a settlement price at theclose of the market each day for each contract and marking all openpositions to that price, referred to as “mark to market.” Every contractis debited or credited based on that trading session's gains or losses.As prices move for or against a position, funds flow into and out of thetrading account. In the case of the CME, each business day by 6:40 a.m.Chicago time, based on the mark-to-the-market of all open positions tothe previous trading day's settlement price, the clearing house pays toor collects cash from each clearing member. This cash flow, known assettlement variation, is performed by CME's settlement banks based oninstructions issued by the clearing house. All payments to andcollections from clearing members are made in “same-day” funds. Inaddition to the 6:40 a.m. settlement, a daily intra-day mark-to-themarket of all open positions, including trades executed during theovernight GLOBEX®, the CME's electronic trading systems, trading sessionand the current day's trades matched before 11:15 a.m., is performedusing current prices. The resulting cash payments are made intra-day forsame day value. In times of extreme price volatility, the clearing househas the authority to perform additional intra-day mark-to-the-marketcalculations on open positions and to call for immediate payment ofsettlement variation. CME's mark-to-the-market settlement system differsfrom the settlement systems implemented by many other financial markets,including the interbank, Treasury securities, over-the-counter foreignexchange and debt, options, and equities markets, where participantsregularly assume credit exposure to each other. In those markets, thefailure of one participant may have a ripple effect on the solvency ofthe other participants. Conversely, CME's mark-to-the-market system doesnot allow losses to accumulate over time or allow a market participantthe opportunity to defer losses associated with market positions.

While the disclosed embodiments may be discussed in relation to futuresand/or options on futures trading, it should be appreciated that thedisclosed embodiments may be applicable to any equity, fixed incomesecurity, currency, commodity, options or futures trading system ormarket now available or later developed. It should be appreciated that atrading environment, such as a futures exchange as described herein,implements one or more economic markets where rights and obligations maybe traded. As such, a trading environment may be characterized by a needto maintain market integrity, transparency, predictability,fair/equitable access, and participant expectations with respectthereto. For example, an exchange must respond to inputs, such as traderorders, cancelations, etc., in a manner as expected by the marketparticipants, such as based on market data, e.g., prices, availablecounter-orders, etc., to provide an expected level of certainty thattransactions may occur in a consistent and predictable manner andwithout unknown or unascertainable risks. In addition, it should beappreciated that electronic trading systems further impose additionalexpectations and demands by market participants as to transactionprocessing speed, latency, capacity, and response time, while creatingadditional complexities relating thereto. The disclosed embodiments mayfurther include functionality to ensure that the expectations of marketparticipants are met, e.g., that transactional integrity and predictablesystem responses are maintained.

As was discussed above, electronic trading systems ideally attempt tooffer an efficient, fair, and balanced market where market pricesreflect a true consensus of the value of products traded among themarket participants, where the intentional or unintentional influence ofany one market participant is minimized if not eliminated, and whereunfair or inequitable advantages with respect to information access areminimized if not eliminated.

Although described below in connection with examples involvinginstruments having multiple components, such as calendar and butterflyspread instruments, the methods described herein are well suited fordetermining final values for any variety of objects conforming to a setof rules or relationships.

Generally, the disclosed embodiments may enable the profiling of amarket participant using machine learning techniques. A model trained ineither an unsupervised or supervised manner identifies normal tradingpatterns for participants. The model classifies similar data togetherand learns to make predictions from the data. Then model may be used toproactively monitor the current trading patterns of a participant andalert before hard coded limits are breached. The model uses bothparticipant data and market data, both past and present to identifypatterns. The model is updated as new data is received. With the orderentry volumes and execution speeds involved in markets due to highfrequency and algorithmic traders, the model allows for abnormalactivity to be identified and deflected when trading algorithms aremisbehaving.

When a computer processor attempts to compute a large number of datasets in an environment including rules constraints and data constraints,the number of possible solutions or combinations of values may becomeunwieldy. A generic computer structure may not be able to handle thedata processing required to accurately and timely identify and addressabnormal activity. The disclosed embodiments allow for the computerprocessing system to efficiently and accurately use structured neuralnetworks to provide risk control, detect abnormal market activity, andprevent related losses. The disclosed embodiments allow for timely andaccurate risk control allowing the market to function efficiency.

The disclosed embodiments may be applicable to contracts for any type ofunderlier, commodity, equity, option, or futures trading system ormarket now available or later developed. The disclosed embodiments arealso not limited to intra-market spread instruments, and accordingly mayalso be used in connection with inter-market spread instruments forcontracts associated with different commodities.

While the disclosed embodiments may be described in reference to theCME, it should be appreciated that these embodiments are applicable toany exchange. Such other exchanges may include a clearing house that,like the CME clearing house, clears, settles and guarantees all matchedtransactions in contracts of the exchange occurring through itsfacilities. In addition, such clearing houses establish and monitorfinancial requirements for clearing members and convey certain clearingprivileges in conjunction with the relevant exchange markets.

The methods and systems described herein may be integrated or otherwisecombined with other various risk management methods and systems, such asthe risk management methods and systems described in U.S. Pat. No.7,769,667 entitled “System and Method for Activity Based Margining” (the'667 Patent”), the entire disclosure of which is incorporated byreference herein and relied upon. For example, the methods and systemsdescribed herein may be configured as a component or module of the riskmanagement systems described in the above-referenced patent.Alternatively, or additionally, the disclosed methods may generate datato be provided to the systems described in the above-referenced patent.

In one embodiment, the disclosed methods and systems are integrated orotherwise combined with the risk management system implemented by CMEcalled Standard Portfolio Analysis of Risk™ (SPAN®). The SPAN systembases performance bond requirements on the overall risk of theportfolios using parameters as determined by CME's Board of Directors,and thus represents a significant improvement over other performancebond systems, most notably those that are “strategy-based” or“delta-based.” Further details regarding SPAN are set forth in the '667Patent.

The embodiments may be described in terms of a distributed computingsystem. The particular examples identify a specific set of componentsuseful in a futures and options exchange. However, many of thecomponents and inventive features are readily adapted to otherelectronic trading environments. The specific examples described hereinmay teach specific protocols and/or interfaces, although it should beunderstood that the principles involved may be extended to, or appliedin, other protocols and interfaces.

It should be appreciated that the plurality of entities utilizing orinvolved with the disclosed embodiments, e.g., the market participants,may be referred to by other nomenclature reflecting the role that theparticular entity is performing with respect to the disclosedembodiments and that a given entity may perform more than one roledepending upon the implementation and the nature of the particulartransaction being undertaken, as well as the entity's contractual and/orlegal relationship with another market participant and/or the exchange.

It should be appreciated that the disclosed embodiments may use othertypes of messages depending upon the implementation. Further, themessages may comprise one or more data packets, datagrams or othercollection of data formatted, arranged configured and/or packaged in aparticular one or more protocols, e.g., the FIX protocol, TCP/IP,Ethernet, etc., suitable for transmission via a network 214 as wasdescribed, such as the message format and/or protocols described in U.S.Pat. No. 7,831,491 and U.S. Patent Publication No. 2005/0096999 A1, bothof which are incorporated by reference herein in their entireties andrelied upon. Further, the disclosed message management system may beimplemented using an open message standard implementation, such as FIXBinary, FIX/FAST, or by an exchange-provided API.

An exemplary trading network environment for implementing tradingsystems and methods is shown in FIG. 1 . An exchange computer system 100receives messages that include orders and transmits market data relatedto orders and trades to users, such as via wide area network 126 and/orlocal area network 124 and computer devices 114, 116, 118, 120 and 122,as will be described below, coupled with the exchange computer system100.

Herein, the phrase “coupled with” is defined to mean directly connectedto or indirectly connected through one or more intermediate components.Such intermediate components may include both hardware and softwarebased components. Further, to clarify the use in the pending claims andto hereby provide notice to the public, the phrases “at least one of<A>, <B>, . . . and <N>” or “at least one of <A>, <B>, . . . <N>, orcombinations thereof” are defined by the Applicant in the broadestsense, superseding any other implied definitions here before orhereinafter unless expressly asserted by the Applicant to the contrary,to mean one or more elements selected from the group comprising A, B, .. . and N, that is to say, any combination of one or more of theelements A, B, . . . or N including any one element alone or incombination with one or more of the other elements which may alsoinclude, in combination, additional elements not listed.

The exchange computer system 100 may be implemented with one or moremainframe, desktop, or other computers, such as the example computer 200described below with respect to FIG. 2 . A user database 102 may beprovided which includes information identifying traders and other usersof exchange computer system 100, such as account numbers or identifiers,user names and passwords. An account data module 104 may be providedwhich may process account information that may be used during trades.

A match engine module 106 may be included to match bid and offer pricesand may be implemented with software that executes one or morealgorithms for matching bids and offers. A trade database 108 may beincluded to store information identifying trades and descriptions oftrades. In particular, a trade database may store informationidentifying the time that a trade took place and the contract price. Anorder book module 110 may be included to compute or otherwise determinecurrent bid and offer prices, e.g., in a continuous auction market. Amarket data module 112 may be included to collect market data andprepare the data for transmission to users.

A risk management module 134 may be included to compute and determine auser's risk utilization in relation to the user's defined riskthresholds. The risk management module 134 may also be configured todetermine risk assessments or exposure levels in connection withpositions held by a market participant. The risk management module 134may be coupled with an activity module 142 that is configured toidentify non-normal activity. The risk management module 134 may beconfigured to administer, manage or maintain one or more marginingmechanisms implemented by the exchange computer system 100. Suchadministration, management or maintenance may include managing a numberof database records reflective of margin accounts of the marketparticipants. In some embodiments, the risk management module 134implements one or more aspects of the disclosed embodiments, including,for instance, principal component analysis (PCA) based margining, inconnection with interest rate swap (IRS) portfolios.

The activity module 142 may receive input from the trade database,market database, and order processing module. The activity module 142may be configured to model a participant or firm's past activityconsidering market parameters. The activity module 142 may be configuredto identify unexpected new transactions or new transactional risks. Theactivity module 142 may be configured to continuously generate a modelfor each of a customer, firm, or market. The activity module 142 may beconfigured to generate an alert to the Exchange or market participantwhen the activity module 142 detects activity exceeding an abnormalitythreshold level as established by the neural network through priortraining under various market conditions.

An order processing module 136 may be included to decompose delta-based,spread instrument, bulk, and other types of composite orders forprocessing by the order book module 110 and/or the match engine module106. The order processing module 136 may also be used to implement oneor more procedures related to clearing an order.

A settlement module 140 (or settlement processor or other paymentprocessor) may be included to provide one or more functions related tosettling or otherwise administering transactions cleared by theexchange. Settlement module 140 of the exchange computer system 100 mayimplement one or more settlement price determination techniques.Settlement-related functions need not be limited to actions or eventsoccurring at the end of a contract term. For instance, in someembodiments, settlement-related functions may include or involve dailyor other mark to market settlements for margining purposes. In somecases, the settlement module 140 may be configured to communicate withthe trade database 108 (or the memory(ies) on which the trade database108 is stored) and/or to determine a payment amount based on a spotprice, the price of the futures contract or other financial instrument,or other price data, at various times. The determination may be made atone or more points in time during the term of the financial instrumentin connection with a margining mechanism. For example, the settlementmodule 140 may be used to determine a mark to market amount on a dailybasis during the term of the financial instrument. Such determinationsmay also be made on a settlement date for the financial instrument forthe purposes of final settlement.

In some embodiments, the settlement module 140 may be integrated to anydesired extent with one or more of the other modules or processors ofthe exchange computer system 100. For example, the settlement module 140and the risk management module 134 may be integrated to any desiredextent. In some cases, one or more margining procedures or other aspectsof the margining mechanism(s) may be implemented by the settlementmodule 140.

One skilled in the art will appreciate that one or more modulesdescribed herein may be implemented using, among other things, atangible computer-readable medium comprising computer-executableinstructions (e.g., executable software code). Alternatively, modulesmay be implemented as software code, firmware code, specificallyconfigured hardware or processors, and/or a combination of theaforementioned. For example, the modules may be embodied as part of anexchange 100 for financial instruments. It should be appreciated thedisclosed embodiments may be implemented as a different or separatemodule of the exchange computer system 100, or a separate computersystem coupled with the exchange computer system 100 so as to haveaccess to margin account record, pricing, and/or other data. Asdescribed above, the disclosed embodiments may be implemented as acentrally accessible system or as a distributed system, e.g., where someof the disclosed functions are performed by the computer systems of themarket participants.

The trading network environment shown in FIG. 1 includes exemplarycomputer devices 114, 116, 118, 120 and 122 which depict differentexemplary methods or media by which a computer device may be coupledwith the exchange computer system 100 or by which a user maycommunicate, e.g., send and receive, trade or other informationtherewith. It should be appreciated that the types of computer devicesdeployed by traders and the methods and media by which they communicatewith the exchange computer system 100 is implementation dependent andmay vary and that not all of the depicted computer devices and/ormeans/media of communication may be used and that other computer devicesand/or means/media of communications, now available or later developedmay be used. Each computer device, which may comprise a computer 200described in more detail below with respect to FIG. 2 , may include acentral processor, specifically configured or otherwise, that controlsthe overall operation of the computer and a system bus that connects thecentral processor to one or more conventional components, such as anetwork card or modem. Each computer device may also include a varietyof interface units and drives for reading and writing data or files andcommunicating with other computer devices and with the exchange computersystem 100. Depending on the type of computer device, a user mayinteract with the computer with a keyboard, pointing device, microphone,pen device or other input device now available or later developed.

An exemplary computer device 114 is shown directly connected to exchangecomputer system 100, such as via a T1 line, a common local area network(LAN) or other wired and/or wireless medium for connecting computerdevices, such as the network 220 shown in FIG. 2 and described belowwith respect thereto. The exemplary computer device 114 is further shownconnected to a radio 132. The user of radio 132, which may include acellular telephone, smart phone, or other wireless proprietary and/ornon-proprietary device, may be a trader or exchange employee. The radiouser may transmit orders or other information to the exemplary computerdevice 114 or a user thereof. The user of the exemplary computer device114, or the exemplary computer device 114 alone and/or autonomously, maythen transmit the trade or other information to the exchange computersystem 100.

Exemplary computer devices 116 and 118 are coupled with a local areanetwork (“LAN”) 124 which may be configured in one or more of thewell-known LAN topologies, e.g., star, daisy chain, etc., and may use avariety of different protocols, such as Ethernet, TCP/IP, etc. Theexemplary computer devices 116 and 118 may communicate with each otherand with other computer and other devices which are coupled with the LAN124. Computer and other devices may be coupled with the LAN 124 viatwisted pair wires, coaxial cable, fiber optics or other wired orwireless media. As shown in FIG. 1 , an exemplary wireless personaldigital assistant device (“PDA”) 122, such as a mobile telephone, tabletbased compute device, or other wireless device, may communicate with theLAN 124 and/or the Internet 126 via radio waves, such as via Wi-Fi,Bluetooth and/or a cellular telephone based data communicationsprotocol. PDA 122 may also communicate with exchange computer system 100via a conventional wireless hub 128.

FIG. 1 also shows the LAN 124 coupled with a wide area network (“WAN”)126 which may be comprised of one or more public or private wired orwireless networks. In one embodiment, the WAN 126 includes the Internet126. The LAN 124 may include a router to connect LAN 124 to the Internet126. Exemplary computer device 120 is shown coupled directly to theInternet 126, such as via a modem, DSL line, satellite dish or any otherdevice for connecting a computer device to the Internet 126 via aservice provider therefore as is known. LAN 124 and/or WAN 126 may bethe same as the network 220 shown in FIG. 2 and described below withrespect thereto.

Users of the exchange computer system 100 may include one or more marketmakers 130 which may maintain a market by providing constant bid andoffer prices for a derivative or security to the exchange computersystem 100, such as via one of the exemplary computer devices depicted.The exchange computer system 100 may also exchange information withother match or trade engines, such as trade engine 138. One skilled inthe art will appreciate that numerous additional computers and systemsmay be coupled to exchange computer system 100. Such computers andsystems may include clearing, regulatory and fee systems.

The operations of computer devices and systems shown in FIG. 1 may becontrolled by computer-executable instructions stored on anon-transitory computer-readable medium. For example, the exemplarycomputer device 116 may store computer-executable instructions forreceiving order information from a user, transmitting that orderinformation to exchange computer system 100 in electronic messages,extracting the order information from the electronic messages, executingactions relating to the messages, and/or calculating values fromcharacteristics of the extracted order to facilitate matching orders andexecuting trades. In another example, the exemplary computer device 118may include computer-executable instructions for receiving market datafrom exchange computer system 100 and displaying that information to auser. In another example, the exemplary computer device 118 may includea non-transitory computer-readable medium that stores instructions formodeling participant activity.

Numerous additional servers, computers, handheld devices, personaldigital assistants, telephones, and other devices may also be connectedto exchange computer system 100. Moreover, one skilled in the art willappreciate that the topology shown in FIG. 1 is merely an example andthat the components shown in FIG. 1 may include other components notshown and be connected by numerous alternative topologies.

Referring to FIG. 2 , an illustrative embodiment of a general computersystem 200 is shown. The computer system 200 may include a set ofinstructions that may be executed to cause the computer system 200 toperform any one or more of the methods or computer based functionsdisclosed herein. The computer system 200 may operate as a standalonedevice or may be connected, e.g., using a network, to other computersystems or peripheral devices. Any of the components discussed above,such as the processor 202, may be a computer system 200 or a componentin the computer system 200. The computer system 200 may be specificallyconfigured to implement a match engine, margin processing, riskanalysis, payment or clearing function on behalf of an exchange, such asthe Chicago Mercantile Exchange, of which the disclosed embodiments area component thereof.

In a networked deployment, the computer system 200 may operate in thecapacity of a server or as a client user computer in a client-serveruser network environment, or as a peer computer system in a peer-to-peer(or distributed) network environment. The computer system 200 may alsobe implemented as or incorporated into various devices, such as apersonal computer (PC), a tablet PC, a set-top box (STB), a personaldigital assistant (PDA), a mobile device, a palmtop computer, a laptopcomputer, a desktop computer, a communications device, a wirelesstelephone, a land-line telephone, a control system, a camera, a scanner,a facsimile machine, a printer, a pager, a personal trusted device, aweb appliance, a network router, switch or bridge, or any other machinecapable of executing a set of instructions (sequential or otherwise)that specify actions to be taken by that machine. In a particularembodiment, the computer system 200 may be implemented using electronicdevices that provide voice, video, or data communication. Further, whilea single computer system 200 is illustrated, the term “system” shallalso be taken to include any collection of systems or sub-systems thatindividually or jointly execute a set, or multiple sets, of instructionsto perform one or more computer functions.

As illustrated in FIG. 2 , the computer system 200 may include aprocessor 202, e.g., a central processing unit (CPU), a graphicsprocessing unit (GPU), or both. The processor 202 may be a component ina variety of systems. For example, the processor 202 may be part of astandard personal computer or a workstation. The processor 202 may beone or more general processors, digital signal processors, specificallyconfigured processors, application specific integrated circuits, fieldprogrammable gate arrays, servers, networks, digital circuits, analogcircuits, combinations thereof, or other now known or later developeddevices for analyzing and processing data. The processor 202 mayimplement a software program, such as code generated manually (i.e.,programmed).

The computer system 200 may include a memory 204 that may communicatevia a bus 208. The memory 204 may be a main memory, a static memory, ora dynamic memory. The memory 204 may include, but is not limited to,computer readable storage media such as various types of volatile andnon-volatile storage media, including but not limited to random accessmemory, read-only memory, programmable read-only memory, electricallyprogrammable read-only memory, electrically erasable read-only memory,flash memory, magnetic tape or disk, optical media and the like. In oneembodiment, the memory 204 includes a cache or random access memory forthe processor 202. In alternative embodiments, the memory 204 isseparate from the processor 202, such as a cache memory of a processor,the system memory, or other memory. The memory 204 may be an externalstorage device or database for storing data. Examples include a harddrive, compact disc (“CD”), digital video disc (“DVD”), memory card,memory stick, floppy disc, universal serial bus (“USB”) memory device,or any other device operative to store data. The memory 204 is operableto store instructions executable by the processor 202. The functions,acts or tasks illustrated in the figures or described herein may beperformed by the programmed processor 202 executing the instructions 212stored in the memory 204. The functions, acts or tasks are independentof the particular type of instructions set, storage media, processor orprocessing strategy and may be performed by software, hardware,integrated circuits, firm-ware, micro-code and the like, operating aloneor in combination. Likewise, processing strategies may includemultiprocessing, multitasking, parallel processing, and the like.

As shown, the computer system 200 may further include a display unit214, such as a liquid crystal display (LCD), an organic light emittingdiode (OLED), a flat panel display, a solid state display, a cathode raytube (CRT), a projector, a printer or other now known or later developeddisplay device for outputting determined information. The display 214may act as an interface for the user to see the functioning of theprocessor 202, or specifically as an interface with the software storedin the memory 204 or in the drive unit 206.

Additionally, the computer system 200 may include an input device 216configured to allow a user to interact with any of the components ofsystem 200. The input device 216 may be a number pad, a keyboard, or acursor control device, such as a mouse, or a joystick, touch screendisplay, remote control, or any other device operative to interact withthe system 200.

In a particular embodiment, as depicted in FIG. 2 , the computer system200 may also include a disk or optical drive unit 206. The disk driveunit 206 may include a computer-readable medium 210 in which one or moresets of instructions 212, e.g., software, may be embedded. Further, theinstructions 212 may embody one or more of the methods or logic asdescribed herein. In a particular embodiment, the instructions 212 mayreside completely, or at least partially, within the memory 204 and/orwithin the processor 202 during execution by the computer system 200.The memory 204 and the processor 202 also may include computer-readablemedia as discussed above.

The present disclosure contemplates a computer-readable medium thatincludes instructions 212 or receives and executes instructions 212responsive to a propagated signal, so that a device connected to anetwork 220 may communicate voice, video, audio, images, or any otherdata over the network 220. Further, the instructions 212 may betransmitted or received over the network 220 via a communicationinterface 218. The communication interface 218 may be a part of theprocessor 202 or may be a separate component. The communicationinterface 218 may be created in software or may be a physical connectionin hardware. The communication interface 218 is configured to connectwith a network 220, external media, the display 214, or any othercomponents in system 200, or combinations thereof. The connection withthe network 220 may be a physical connection, such as a wired Ethernetconnection or may be established wirelessly as discussed below.Likewise, the additional connections with other components of the system200 may be physical connections or may be established wirelessly.

The network 220 may include wired networks, wireless networks, orcombinations thereof. The wireless network may be a cellular telephonenetwork, an 802.11, 802.16, 802.20, or WiMax network. Further, thenetwork 220 may be a public network, such as the Internet, a privatenetwork, such as an intranet, or combinations thereof, and may utilize avariety of networking protocols now available or later developedincluding, but not limited to, TCP/IP based networking protocols.

Embodiments of the subject matter and the functional operationsdescribed in this specification may be implemented in digital electroniccircuitry, or in computer software, firmware, or hardware, including thestructures disclosed in this specification and their structuralequivalents, or in combinations of one or more of them. Embodiments ofthe subject matter described in this specification may be implemented asone or more computer program products, i.e., one or more modules ofcomputer program instructions encoded on a computer readable medium forexecution by, or to control the operation of, data processing apparatus.While the computer-readable medium is shown to be a single medium, theterm “computer-readable medium” includes a single medium or multiplemedia, such as a centralized or distributed database, and/or associatedcaches and servers that store one or more sets of instructions. The term“computer-readable medium” shall also include any medium that is capableof storing, encoding or carrying a set of instructions for execution bya processor or that cause a computer system to perform any one or moreof the methods or operations disclosed herein. The computer readablemedium may be a machine-readable storage device, a machine-readablestorage substrate, a memory device, or a combination of one or more ofthem. The term “data processing apparatus” encompasses all apparatus,devices, and machines for processing data, including by way of example aprogrammable processor, a computer, or multiple processors or computers.The apparatus may include, in addition to hardware, code that creates anexecution environment for the computer program in question, e.g., codethat constitutes processor firmware, a protocol stack, a databasemanagement system, an operating system, or a combination of one or moreof them.

In a particular non-limiting, exemplary embodiment, thecomputer-readable medium may include a solid-state memory such as amemory card or other package that houses one or more non-volatileread-only memories. Further, the computer-readable medium may be arandom access memory or other volatile re-writable memory. Additionally,the computer-readable medium may include a magneto-optical or opticalmedium, such as a disk or tapes or other storage device to capturecarrier wave signals such as a signal communicated over a transmissionmedium. A digital file attachment to an e-mail or other self-containedinformation archive or set of archives may be considered a distributionmedium that is a tangible storage medium. Accordingly, the disclosure isconsidered to include any one or more of a computer-readable medium or adistribution medium and other equivalents and successor media, in whichdata or instructions may be stored.

In an alternative embodiment, dedicated or otherwise specificallyconfigured hardware implementations, such as application specificintegrated circuits, programmable logic arrays and other hardwaredevices, may be constructed to implement one or more of the methodsdescribed herein. Applications that may include the apparatus andsystems of various embodiments may broadly include a variety ofelectronic and computer systems. One or more embodiments describedherein may implement functions using two or more specific interconnectedhardware modules or devices with related control and data signals thatmay be communicated between and through the modules, or as portions ofan application-specific integrated circuit. Accordingly, the presentsystem encompasses software, firmware, and hardware implementations.

In accordance with various embodiments of the present disclosure, themethods described herein may be implemented by software programsexecutable by a computer system. Further, in an exemplary, non-limitedembodiment, implementations may include distributed processing,component/object distributed processing, and parallel processing.Alternatively, virtual computer system processing may be constructed toimplement one or more of the methods or functionality as describedherein.

Although the present specification describes components and functionsthat may be implemented in particular embodiments with reference toparticular standards and protocols, the invention is not limited to suchstandards and protocols. For example, standards for Internet and otherpacket switched network transmission (e.g., TCP/IP, UDP/IP, HTML, HTTP,HTTPS) represent examples of the state of the art. Such standards areperiodically superseded by faster or more efficient equivalents havingessentially the same functions. Accordingly, replacement standards andprotocols having the same or similar functions as those disclosed hereinare considered equivalents thereof.

A computer program (also known as a program, software, softwareapplication, script, or code) may be written in any form of programminglanguage, including compiled or interpreted languages, and it may bedeployed in any form, including as a standalone program or as a module,component, subroutine, or other unit suitable for use in a computingenvironment. A computer program does not necessarily correspond to afile in a file system. A program may be stored in a portion of a filethat holds other programs or data (e.g., one or more scripts stored in amarkup language document), in a single file dedicated to the program inquestion, or in multiple coordinated files (e.g., files that store oneor more modules, sub programs, or portions of code). A computer programmay be deployed to be executed on one computer or on multiple computersthat are located at one site or distributed across multiple sites andinterconnected by a communication network.

The processes and logic flows described in this specification may beperformed by one or more programmable processors executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows may also be performedby, and apparatus may also be implemented as, special purpose logiccircuitry, e.g., an FPGA (field programmable gate array) or an ASIC(application specific integrated circuit).

Processors suitable for the execution of a computer program include, byway of example, both general and special purpose microprocessors, andanyone or more processors of any kind of digital computer. Generally, aprocessor will receive instructions and data from a read only memory ora random-access memory or both. The essential elements of a computer area processor for performing instructions and one or more memory devicesfor storing instructions and data. Generally, a computer will alsoinclude, or be operatively coupled to receive data from or transfer datato, or both, one or more mass storage devices for storing data, e.g.,magnetic, magneto optical disks, or optical disks. However, a computerneed not have such devices. Moreover, a computer may be embedded inanother device, e.g., a mobile telephone, a personal digital assistant(PDA), a mobile audio player, a Global Positioning System (GPS)receiver, to name just a few. Computer readable media suitable forstoring computer program instructions and data include all forms ofnon-volatile memory, media and memory devices, including by way ofexample semiconductor memory devices, e.g., EPROM, EEPROM, and flashmemory devices; magnetic disks, e.g., internal hard disks or removabledisks; magneto optical disks; and CD ROM and DVD-ROM disks. Theprocessor and the memory may be supplemented by, or incorporated in,special purpose logic circuitry.

To provide for interaction with a user, embodiments of the subjectmatter described in this specification may be implemented on a devicehaving a display, e.g., a CRT (cathode ray tube) or LCD (liquid crystaldisplay) monitor, for displaying information to the user and a keyboardand a pointing device, e.g., a mouse or a trackball, by which the usermay provide input to the computer. Other kinds of devices may be used toprovide for interaction with a user as well. Feedback provided to theuser may be any form of sensory feedback, e.g., visual feedback,auditory feedback, or tactile feedback. Input from the user may bereceived in any form, including acoustic, speech, or tactile input.

Embodiments of the subject matter described in this specification may beimplemented in a computing system that includes a back end component,e.g., a data server, or that includes a middleware component, e.g., anapplication server, or that includes a front end component, e.g., aclient computer having a graphical user interface or a Web browserthrough which a user may interact with an implementation of the subjectmatter described in this specification, or any combination of one ormore such back end, middleware, or front end components. The componentsof the system may be interconnected by any form or medium of digitaldata communication, e.g., a communication network. Examples ofcommunication networks include a local area network (“LAN”) and a widearea network (“WAN”), e.g., the Internet.

The computing system may include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other. Asystem may depend on certain rules, logic, and inter-related objects anddata. In technical and computing environments, a system may calculatevalues for multiple objects subject to rules, e.g., business orenvironment logic, associated with the objects. Certain object types mayalso depend on other object types.

FIG. 3 depicts an illustrative embodiment of an activity module 142.FIG. 3 includes a neural network 320, a risk processor 324, a networkinterface 326, an activity profiler 328, and a message transmitter 330.The activity module 142 may be connected to systems or machines outsidethe exchange system. The activity module 142 may communicate with users,traders, and brokers outside of the exchange system, such as via widearea network 126 and/or local area network 124 and computer devices 114,116, 118, 120 and 122. The activity module 142 may be configured tomonitor transactions, identify abnormal transaction, and generate andtransmit an alert message. The activity module 142 may be configured totrain a recurrent neural network 320 using historical transaction andmarket data. The activity module 142 may be configured to comparereceived transactions with historical transactions in consideration ofcurrent external factors, using the recurrent neural network 320. Theactivity module 142 may be implemented in part as an application on oneof the computer devices 114, 116, 118, 120 and 122. The activity module142 may be part of the exchange computer system 100.

The risk processor 324 may be configured to generate a risk profile of aparticipant or firm and a risk profile for a transactional environment.The risk processor 324 may receive input from the network interface 326and transmit data to the neural network 320. The input from the networkinterface 326 may include transaction data or market factor data, forexample, received from the risk management module 134, order processingmodule 136, market data module 112, or other component of the exchange.The transaction data may include, for example, order, fill, or otherdata relating to one or more transactions or transaction requests. Thenetwork interface 326 may further communicate directly with aparticipant or a source for market data. Risk processor 324 may generatefrom the received data, one or more risk profiles. A risk profile may bebased on a statistical technique referred to as value at risk (VaR). VaRdetermines a potential for loss for the participant being assessed, aswell as the probability of occurrence for the defined loss. VaR ismeasured by assessing the amount of potential loss, the probability ofoccurrence for the amount of loss and the time frame. VaR may be appliedto a participant, a firm, a market, an individual, or other entity. VaRmay be calculated for different periods of time and may include currenttransactional data. In an embodiment, the risk profile may be based onprofit and loss over a period of time. In an embodiment, the riskprofile may be based on a function provided by a participant. The riskprocessor 324 may be implemented as a separate component or as one ormore logic components, such as on an FPGA which may include a memory orreconfigurable component to store logic and a processing component toexecute the stored logic, or as first logic, e.g. computer programlogic, stored in a memory, such as the memory 204 shown in FIG. 2 anddescribed in more detail above with respect thereto, or othernon-transitory computer readable medium, and executable by a processor,such as the processor 202 shown in FIG. 2 and described in more detailabove with respect thereto, to cause the risk processor 324 to, orotherwise be operative to generate a risk profile. The risk processor324 may store transaction and market data in a database 322. The riskprocessor 324 may store a plurality of generated risk profiles in thedatabase 322.

The database 322 may be configured to store transaction data, externalfactor data, or generated risk profiles for one or more participants,firms, or market environments. The transaction data in the database 322may correspond to external factor data or vice versa. For example, thedatabase 322 may store the external factors that exist when eachtransaction is received. The database 322 may include fewer entries forthe external factors than the transaction data. For example, theexternal factors may be calculated for a time period where there aremultiple transactions by the participant. The external factorscalculated for the time period may then correspond to each of thetransactions that occurs during the period. The risk profile data may begenerated by the risk processor 324 and may include risk profiles for asingle participant, a firm, a collection of participants, a singlemarket, a collection of market, etc. The risk profile data may includemultiple risk profiles for each of the entities, for example eachcalculated in a different manner.

The database 322 may be implemented as a separate component or as one ormore logic components, such as on an FPGA which may include a memory orreconfigurable component to store logic and a processing component toexecute the stored logic, or as first logic, e.g. computer programlogic, stored in a memory, such as the memory 204 shown in FIG. 2 anddescribed in more detail above with respect thereto, or othernon-transitory computer readable medium, and executable by a processor,such as the processor 202 shown in FIG. 2 and described in more detailabove with respect thereto, to cause the database to, or otherwise beoperative to store a plurality of parameters.

The neural network 320 may be configured to identify one or morepatterns in a set of historical data. The neural network 320 may beconfigured to identify relationships between inputs in a set ofhistorical data. The neural network 320 may be configured to receivedata from the database 322 of the risk processor 324. The neural network320 may receive data directly from the network interface 326. The neuralnetwork 320 may be configured to learn the normal trading profile of aparticipant during a trade day based on the products traded and to learnthe patterns of the product itself. A large data set may be run throughthe model to enable the internal structure of the model to be trained.The data set may be encoded by the model and stored as a trading patterndatabase. The neural network 320 may be trained in a supervised manneror may be trained in an unsupervised manner.

The neural network 320 may be configured to compare received transactiondata and other environmental data to historical transactions andhistorical environmental data to determine if the current activitydeviates from the historical activity considering the state of theenvironment. The neural network 320 may be implemented as a separatecomponent or as one or more logic components, such as on an FPGA whichmay include a memory or reconfigurable component to store logic and aprocessing component to execute the stored logic, or as first logic,e.g. computer program logic, stored in a memory, such as the memory 204shown in FIG. 2 and described in more detail above with respect thereto,or other non-transitory computer readable medium, and executable by aprocessor, such as the processor 202 shown in FIG. 2 and described inmore detail above with respect thereto, to cause the neural network to,or otherwise be operative to identify one or more patterns and determinea similarity between normal activity and current activity. The neuralnetwork 320 may be a structured neural network represented by a set ofinterconnected nodes that are configured to identify patterns in a setof data. The interconnected nodes may be grouped together in an encoder340 and a decoder 342.

The activity profiler 328 may be configured to receive data from theneural network 320 that describes a level of deviation from normalactivity. The activity profiler 328 may compare the level of deviationto a threshold level and determine an action that should be taken. Forexample, if the level of deviation exceeds an alert threshold level, theactivity profiler 328 may generate an alert or instruct the messagetransmitter 330 to generate an alert. If the level of deviation exceedsa slowdown threshold, the activity profiler 328 may generate aninstruction to slow down order from a participant. The activity profiler328 may be implemented as a separate component or as one or more logiccomponents, such as on an FPGA which may include a memory orreconfigurable component to store logic and a processing component toexecute the stored logic, or as first logic, e.g., computer programlogic, stored in a memory, such as the memory 204 shown in FIG. 2 anddescribed in more detail above with respect thereto, or othernon-transitory computer readable medium, and executable by a processor,such as the processor 202 shown in FIG. 2 and described in more detailabove with respect thereto, to cause the activity profiler 328 todetermine an action as a function of a level of deviation.

The message transmitter 330 may be configured to generate and transmitalert messages. The message transmitter 330 may communicate with thenetwork interface 326 to transmit a generated message. The messagetransmitter 330 may be implemented as a separate component or as one ormore logic components, such as on an FPGA which may include a memory orreconfigurable component to store logic and a processing component toexecute the stored logic, or as first logic, e.g., computer programlogic, stored in a memory, such as the memory 204 shown in FIG. 2 anddescribed in more detail above with respect thereto, or othernon-transitory computer readable medium, and executable by a processor,such as the processor 202 shown in FIG. 2 and described in more detailabove with respect thereto, to cause the message transmitter 330 to, orotherwise be operative to generate and transmit an alert message.

FIG. 4 depicts a plurality of nodes (I1-I3, H1-H4, and O1-O2) in anexample neural network 320. Each node has a weighted connection(indicated by the arrows) to one or more other linked nodes in adjacentlayers. There are three layers in FIG. 4 , an input layer, a hiddenlayer, and an output layer. There may be multiple hidden layersdepending on the complexity of the neural network 320. Nodes take inputreceived from linked nodes and use the weights of the connected nodestogether with a function for computation of output values. Neuralnetworks may be created for supervised and/or unsupervised learning. Thenumber of hidden layers along with the number of nodes within a specifichidden layer may be adjusted to achieve different levels of results.

As describe above, different types of neural networks exist. Twodifferent types of neural networks are referred to as feedforwardnetworks and recurrent networks. Both networks are named after the waythe neural networks channel information through a series of operationsperformed at the nodes of the network. One (feedfoward) feedsinformation straight through (never touching a given node twice), theother (recurrent) cycles information through a loop.

In the case of feedforward networks, information is input to the networkand transformed into an output. In an example of a feedforward network,the nodes map raw data to categories, recognizing patterns that signal,for example, that an input image is labeled. Using the example of imagerecognition, a feedforward network is trained on labeled images untilthe feedforward network minimizes the error the network makes whenlabeling the categories. With the trained set of parameters, or weights,the network may categorize data that the network has never seen. Atrained feedforward network may be presented a random collection ofphotographs, and the first photograph the network is exposed to may notnecessarily alter how the network classifies the second. Identifying afirst type for a first image may not lead the network to perceive a typeof second image next. As such, a feedforward network has no notion oforder in time, and the only input the network considers is the currentexample the network has been exposed to. Feedforward networks areamnesiacs regarding the previous inputs. Recurrent networks, however,take as inputs not just the current input, but also inputs at least onestep back in time. Using the image recognition example, for a recurrentnetwork seeing a first image may affect how the network classifies asecond image.

In the feedforward network, all inputs (and outputs) may be independentof each other. The drawback for feedforward networks may be that formany tasks the inputs and outputs are not independent of one another.For example, when predicting the next word in a sentence, identifyingwhich words came before the word is beneficial. Recurrent neuralnetworks may alleviate the drawback. Recurrent neural networks arecalled recurrent because the network performs the same task for everyelement of a sequence, with the output taking into consideration theprevious computations. Recurrent neural networks have a “memory” thatcaptures and stores information about what has been calculated.Recurrent neural networks may make use of information in arbitrarilylong sequences, but in practice recurrent neural networks are limited tolooking back only a few steps.

The formulas that govern the computation in a recurrent neural networkmay be described as follows: X(t) is the input at time step T. Forexample, X(1) maybe a one-hot vector (e.g. a 1×N matrix vector)corresponding to the second word of a sentence. S(t) is the hidden stateat time step. The hidden state may be referred to as the “memory” of thenetwork. S(t) is calculated based on the previous hidden state and theinput at the current step, e.g. a function of X(t-1) and W(t-1). Thefunction may be a nonlinearity such as tanh or a rectified linear unit(ReLU). O(t) is the output at step T.

The hidden state may be the memory of the network. S(t) capturesinformation about what happened in all the previous time steps. Theoutput at step O(t) is calculated solely based on the memory at time.While S(t) may in theory capture information from a long sequence, inpractice S(t) may only be able to capture information from a few timesteps ago due to complexity and computational limitations. In anembodiment, a specific type of hidden state may be used that is referredto as long short term memory (LSTM). LSTM may be configured to useinformation from temporally further back in the sequence than a standardnode. LSTMs may be configured to gate (e.g. optionally let in)information, allowing for states to be stored from further back in asequence.

Multiple outputs may not be necessary. For example, when predicting therisk of a transaction, only the final output may be useful (not theintermediary outputs). Similarly, inputs may not be needed at each timestep.

In an embodiment, a type of recurrent neural network referred to as arecurrent bottleneck autoencoder is used to identify patterns in theparticipant and external data. A recurrent bottleneck autoencoder may beconfigured as a recurrent neural network with additional functionality.As described above, a recurrent neural network uses multiple inputs.Like other recurrent neural networks, the decision a recurrentbottleneck autoencoder reached at time step T-1 affects the decision therecurrent bottleneck autoencoder may reach one moment later at time stepT. A recurrent bottleneck autoencoder describes the structure of thenodes, more specifically how the number of nodes in layers decreasesfrom the input to a point (compresses) and then increases (decompresses)to generate an output.

FIG. 5 depicts a recurrent bottleneck autoencoder according to anembodiment. FIG. 5 includes a plurality of nodes (circles) in layers anda plurality of connections (arrows) between the nodes. In an embodiment,a structure of different size in terms on the number of hidden layersand the number of nodes per layer may be used. In an embodiment, thesize of the structure selected may be optimized in terms of thetrade-off between accuracy and computation load. In an embodiment, therecurrent layers may use LSTM Units with a tanh activation on theoutputs and logistic sigmoid gates. Only the outputs of the finalencoder layer are connected to the inputs of the decoder, with noadditional connections between encoder and decoder layers.

As described above, a recurrent neural network may be based on LongShort Term Memory (LSTM). A LSTM network may analyze streams ofinterrelated events and identify patterns between the events that aresimilar and have a high probability of recurrence based on historicaltrends. A LSTM based network may be used to identify similarities invectors representing partially deconstructed data and produce as outputthe complete data or identify similarities between data by isolating andanalyzing the objects within the data.

LSTMs may perform well by isolating different aspects of the input datainto separate characteristics and then establishing relationshipsbetween the characteristics thorough observance of large data sets.LSTMs may not be as fast as other approaches in the modeling phase butare more flexible in establishing complex relationships between inputelements with generalized training algorithms. Once trained the RNNstructure may deliver a logical response to previously unseen inputs. Inan embodiment, the structure established through training may handlelarge number of complex relationships through large number of hiddenlayers and training algorithms that help partition the RNN architectureinto N-Dimensional hyperplanes representing the differentcharacteristics seen in the data. Based on the input a different pack ofnodes activates to indicate the characteristic the nodes have the mostaffinity to and the output is combined into a logical inference.

Referring back to FIG. 5 , the neural network has two stages: an encoderstage including the left side of the network and a decoder stageincluding the right side of the network. During the encoder stage thenumber of hidden units decreases at each stage, effectively compressingthe data. During the decoder stage the compressed data is reconstructed.If an optimized compression may be achieved at the same time as anoptimized reconstruction, then the compressed representation may beexpected to have captured patterns in the data.

To identify an optimized compression and optimized reconstruction, thestructure of the neural network may be trained. The structure may betrained by end to end backpropagation through the encoder and decoder.When an input is presented to the structure, the input is propagatedforward through the structure, layer by layer, until the inputted datareaches the output layer. The output of the network is then compared tothe desired output, using a loss function, and an error value iscalculated for each of the nodes in the output layer. In an embodiment,the inputs to the model may be encoded as a real-valued X-dimensionalvector of participant and external factor parameters. At each time step,an input is fed through the layers of the encoder, with the hiddenstates updating based on the most recent input as well as on theexisting hidden state from previous inputs. After the input sequenceends, the hidden state of the last recurrent layer is used to initializethe hidden state of the first recurrent layer of the decoder. This stateis fed through the decoder layers to produce the output at thefirst-time step. The output is fed back into the input of the next timestep of the decoder, making it a conditional recurrent network. Thetargets for the decoder correspond to the reversed input sequence andthe error of the network is computed as the squared distance betweenoutput and target.

An example system with a recurrent autoencoder may be used to predictthe risk of a transaction based on historical data. The training data isthe risk history for a participant that have been recorded and stored.In the example, an input x represents a value at risk (VaR) for set timeperiods for the participant up to yesterday, and an output y is the VaRof today. The input xis [x0, x1, . . . , xT], where xi is the VaR of dayi-th since the start of the historical data and the output y is the VaRof today. The goal of the example is to train the structure to predict ygiven all the x's. Other inputs may be used, such as external factors.External factors, for example, may be used to identify why a VaR changesfor a specific day or transaction given the external factors.

In a recurrent network, x0, x1, . . . , xT are VaR for a participant upto a current time; h0, h1, . . . , hT are the hidden states of therecurrent network. For a recurrent neural network, there are typicallythree sets of parameters: the input to hidden weights (W), the hidden tohidden weights (U), and the hidden to label weight (V). All the W's areshared, all the U's are shared and all the V's are shared. The weightsharing property makes the network suitable for variable-sized inputs.Even if T grows, the size of the parameters stay the same: only W, U,and V. With the notations, the hidden states are recursively computedas: f(x)=V hT, ht=σ(Uht-1+W xt), for t=T, . . . , 1 . . . h0=σ(W x0) Thecost function is minimized (y−f(x))2 to obtain the appropriate weights.To compute the gradient of the recurrent neural network, backpropagationmay be used.

Backpropagation entails that when an input is presented to thestructure, the input is propagated forward through the structure, layerby layer, until the input reaches the output layer. The output of thenetwork is then compared to the desired output, using a loss function,and an error value is calculated for each of the nodes in the outputlayer.

FIG. 6 depicts an example workflow of the operation of the activitymodule 142 of FIG. 3 . The workflow in FIG. 6 may be used to identifyparameters, establish baselines around the parameters and identifyshifts with un-explained or lack of correlation to other parameters.FIG. 6 depicts a computer implemented method for detecting abnormalactivity by a participant in a data transaction processing system inwhich data items are transacted by a hardware matching processor thatmatches electronic data transaction request messages for the same one ofthe data items based on multiple transaction parameters from differentclient computers over a data communication network.

At act A110, the activity module 142 identifies in a memory, historictransaction data for the participant and historic external factor data.The activity module 142 may receive and store data as new transactionsare received and the external factors are identified. In an embodiment,a risk processor 324 may generate a risk profile using VaR at predefinedtime periods. In an embodiment, the risk processor may generate a riskprofile using profit and loss (P&L) over a period of time. The activitymodule 142 may store information for a time period of a day, a week, amonth, a year, or longer. The length of the time period may be adjusteddepending on the type of transaction, type of participant, or externalfactors. The length of the time period may further be adjusted based oncomputational power. A longer period may include more information. Alonger period may also include data that does not correlate due toexternal events that alter the landscape of the transactionalenvironment. The data received and stored, or stored and identified bythe activity module 142 may be divided into two sets, a participant setthat includes data related to specific transaction initiated by aparticipant and an external factor set that includes data relating toother transactions and for example, a market as a whole.

The participant set may include parameters that are specific to thetransaction traffic initiated by a single source. A single source mayindicate a single trader for example, or a single organization includesmultiple traders or organizations. The parameters may be with referenceto the external factor parameters discussed below. For each transactionspecific parameter, a standard deviation may also be identified andstored. A standard deviation may be a measure of the dispersion of a setof data from a mean value of the data. The standard deviation mayprovide insight into the distribution of data around the mean (average).A data point outside the standard deviation may indicate an abnormalevent. A definition of the size of the standard deviation may be inputby a user or predefined.

The participant set may include data related to historic transaction fora participant over a period of time. The length of the period of timemay be dependent on the participant, the number of transactions togenerate an accurate prediction, or computational limits. Theparticipant set may exclude certain transactions that are not indicativeof the trading pattern of the participant. For example, one or moreabnormal (or erroneous) transactions may be identified and excluded fromthe set of historic transactions. The set of historic transactions maybe used along with the external factors to identify abnormal events. Assuch, any events or transactions that have been deemed abnormal may notbe used to train the structure to identify normal events.

The participant set of data may include data relating to the followingtypes: VaR (Value at Risk)—risk exposure based on probability ofoccurrence of a loss of a certain amount. The data may includedistinctions between Account, Portfolio, or firm level within aparticipant's data. For each transaction, the data may include an ordersize, a standard deviation of size, an incremental VaR associated with anew buy/sell, an order price, a differential of bids/offers from thebest bid/offer (e.g., a mid-point difference), and open order risk. Theparticipant set of data may further include long/short e.g., a standarddeviation of how much outstanding notional value is in the market forthe account on either side of the books. The participant set of data mayinclude data relating to the price or quantify shift. The participantset of data may include data relating to the rate at which orders arebeing sent into the market for taking, a standard deviation of openposition maintained in the market, a standard deviation of how long amarket maker order typically stays on the book. The participant set ofdata may include data relating to a standard deviation of order distancefrom the inside of the market, a distance from a same side of book,and/or a distance from an opposite side of book. The participant set ofdata may include data relating to economic capital, e.g., a comparisonbetween the account value or firm's assets against the Value at Risk andhow the assets are doing against other firms in an exchange portfolio.The participant set of data may include data relating to a credit ratingfor a firm, profit and/or loss, and option Greeks.

The participant set of data may be received and stored or stored andidentified with associated external factor parameters. The externalfactor parameters, also referred to as market factor parameters orenvironmental factors may assist in identifying correlation toparticipant parameters and may explain certain types of activity. Theexternal factors may include, but are not limited to product volatility,e.g., dispersion of price values, market sentiment, e.g., Volatility(VIX) index, Index Health (+/−), Eventful time (+/−), Aggressing OrderRate, Time to expiration, and Economic/market releases, other similarparticipants, or similar firms, etc.

The participant set of data and the external factor parameters may bestored in a memory or database in the activity module 142. The data maybe stored elsewhere in the exchange and accessed by the activity module142 to train new structures. The participant set of data may be providedby a participant. For example, a participant may provide a set of datathat exhibits normal trading activity by the participant (or idealizedtrading activity). The provided set may be associated with externalfactor data stored at the exchange or activity module 142 and then usedto train the structure. The external factor data for example may beassociated with time periods for which the participant transactionaldata may be matched. While each transaction by the participant may bestored, certain parameters in the external factor data may be updatedonce every predefined time period, for example, once every second, everyminute, every hour, every day, etc.

At act A120, the activity module 142 identifies one or more patterns inthe historic transaction data and the historic external factor datausing a structured neural network. The activity module 142 may include astructured neural network. The structured neural network may be trainedto detect patterns or relationships between inputs in a set of data. Aneural network may include a tiered processing architecture made up of aplurality of interconnected processing nodes. Each connection of oneprocessing node to another may be dynamically weighted. The dynamicweights may be adjusted during the training of the structure and as newdata is received and evaluated. Different types of neural networkstructures are possible. In an embodiment, the activity module 142includes a recurrent bottleneck autoencoder. A recurrent bottleneckautoencoder is a type of structured neural network that detects patternsby encoding and decoding data.

Nodes in a recurrent network may input outputs of the node, e.g., thenode may perform a calculation based on previously outputted data. Nodesuse hidden states to store information. Using the hidden states,recurrent networks may possess memory. An example of a hidden statecalculation is given below:

h _(t)=ϕ(Wx _(t) +Uh _(t-1)),

The hidden state at time step t is h(t). The hidden state is a functionof the input at the same time step X(t) modified by a weight matrix Wadded to the hidden state of the previous time step h(t-1) multiplied byits own hidden-state-to-hidden-state matrix., otherwise known as atransition matrix and similar to a Markov chain. The weight matrices arefilters that determine how much importance to accord to both the presentinput and the past hidden state. The error the states generate returnsvia backpropagation and may be used to adjust the weights until theerror may not be reduced or reaches a point that satisfies an errorthreshold or computational limit.

The sum of the weight input and hidden state is squashed by the functionφ—either a logistic sigmoid function or tanh. Because this feedback loopoccurs at every time step in the series, each hidden state containstraces not only of the previous hidden state, but also of all those thatproceded h(t-1) for as long as memory may persist. Given a series ofinputs, a recurrent network uses a previous input to help determine thestructure's perception of the second input.

In an embodiment, the recurrent bottleneck autoencoder may be used inreal time, inputting current transactional activity from the tradingentity and the market events to detect any anomalies in the tradingactivity that could adversely affect the risk profile of the tradingentity.

In an embodiment, the recurrent bottleneck autoencoder identifiesrelationships between a risk profile of a participant and a risk profileof an environment. The risk profile of the participant may be calculatedby a VaR factor that indicates the probability of occurrence of loss bya certain factor by certain amount of time. The risk profile of theenvironment may be calculated by environmental health factors such as asentiment index, volatility, etc. Risk profile factors that are longerterm factors are overlaid with more short term activity factors such asthe aggressing order rate for both the environment and the participantthat provides an indication of ‘panic’ or ‘opportunity’ in theenvironment. The short-term factors may be influenced by the long-termfactors and a reversal in that role is a sign of the risk profilechanging drastically.

The recurrent bottleneck autoencoder identifies the relationshipsbetween the factors at time T as well as with the history of the samefactors in the past at time T-1 and at Time T-2 and so on until Time T-nwhere ‘n’ is a sizeable amount of time during which the environmentshows dependence on historical events and where ‘n’ is calculated byexperimentation in the specific trading asset class. The time period T-nis also sized such that if the sample sets greater than that period istaken then conflicting environment characteristics are observed by therecurrent bottleneck autoencoder that may hinder training.

The correlation is achieved by means of a network of memory cells ornodes of the recurrent bottleneck autoencoder with depth ‘d’ such thatthe output of a node is based not only on the current input but on theweighted value of the previous input in the sequence. The depth ‘d’ ofthe structure may be adjusted through experimentation so that none ofthe Nodes are in the saturated range and are able to clearly classifyall of the sample sets of data from a current time until time T-n in thepast. In an embodiment, the architecture of the recurrent bottleneckautoencoder may be split into a zone of layers for classification and azone of layers for determination of output.

In an embodiment, a structure may include 512 input nodes with 128hidden layer nodes and 64 output layer nodes in the classificationlayers and then repeating that pattern for the layers for decoding theoutput provides for optimal results given the financial parameters aboveand the specific style of market products such as E-Mini, Crude Oil,Natural Gas, Eurodollars, Treasury Notes, Corn, Soybeans, Gold, and FX(EUR/USD, JPY/USD).

Furthermore, sliding the time window of T-n iteratively an input at atime into the RNN in order to a) incorporate variations in the marketfor training the recurrent bottleneck autoencoder and b) in cases ofrecurrent bottleneck autoencoder saturation quickly identify thesequence of events that may have led to an outlier situation and hencethe saturation of the nodes.

At act A130, the activity module 142 receives from the participant, anelectronic data transaction request message comprising data indicativeof a transaction specifying a product, quantity, and value, and storingthe received electronic data transaction request message in the memory.

In an embodiment, the data indicative of the transaction is used tocalculate a current participant profile that describes the outstandingrisks for a participant. The current risk profile of the participant maybe calculated using a risk exposure based on probability of occurrenceof a loss of a certain amount. As each new transaction is received andthe information identified, the current participant risk profile may beupdated.

At act A140, the activity module 142 calculates current external factordata. The external factor parameters, also referred to as market factorparameters may assist in identifying correlation to participantparameters and may explain certain types of activity. The externalfactors may include, but are not limited to product volatility, e.g.,dispersion of price values, market sentiment, e.g., Volatility (VIX)index, Index Health (+/−), Eventful time (+/−), Aggressing Order Rate,Time to expiration, and Economic/market releases.

The external factor data may be calculated for each transaction or maybe calculated for a time period and associated with transactions thatare received or occur during that transaction. In an embodiment, theactivity module receives the current external factor data from, forexample, the exchange. The external factor data may further be receivedfrom an external site or from a participant.

At act A150, the activity module 142 compares the data indicative of thetransaction and the current external factor data with the one or morepatterns. The structure of the recurrent bottleneck autoencoderidentifies one or more patterns in the historical data. The patterns maybe indicative of baseline normal transactional activity by theparticipant given the external factors. The data indicative of the ordermay include a price and volume for a product. The data indicative of theorder may further include additional parameters. From the information inthe electronic data transaction, the activity module 142 may generate aVaR that represents risk exposure based on probability of occurrence ofa loss of a certain amount. The activity module 142 may compare thecurrent transaction (or current risk profile) and current externalfactors with the baseline to determine if the transaction activity isnormal or abnormal.

In an embodiment, the comparison may include determining a distancebetween the two data sets (historical and current). Functions such asusing a metric space or analysis of variance may be used. In anembodiment, the comparison may include inputting the current transactionand current external factor data into the recurrent neural network. Theoutput may be compared to an expected output. The difference between theoutput and the expected output may be used to generate an abnormalityindicator or an abnormality score described below.

At act A160, the activity module 142 generates an abnormality score forthe electronic data transaction based on the comparison. The abnormalityscore may represent a probability of how close a match the currentparticipant's transaction activity or activity profile is to historictrading patterns for the participant. Normal activity may refer to alack of significant deviation from the average activity.

A deviation from normal activity may be defined by using a standarddeviation. For a normal distribution, there is a mean for the data, andthe rest of the data fall symmetrically above and below that mean.Standard deviation as a measure informs how far scores fall on eitherside away from the mean. Standard deviation may represent a measure ofthe dispersion of a set of data from its mean. If the data points arefurther from the mean, there is higher deviation within the data set.Standard deviation may be calculated as the square root of variance bydetermining the variation between each data point relative to the mean.Alternative methods of determining abnormality may be used. A lowstatistical probability may define abnormality.

At act A170, the activity module 142 generates an alert when theabnormality score exceeds a threshold. An alert message may include anelectronic message transmitted to the risk management system or riskmanagement module of an exchange. The exchange may transmit a message tothe participant. In an embodiment, the activity module 142 may prohibita transaction from occurring if the abnormality score exceeds a secondthreshold that indicates that the activity is very abnormal. Veryabnormal may, for example, indicate activity that is more than apredefined level of standard deviations from a mean or normal orexpected activity.

In an embodiment, there may be multiple sets of patterns for aparticipant that describe historical activity for different aspects, forexample, activity modules 142 focused on position (risk), P&L, orderentry (i.e., velocity, volume, and price levels) by product type orbusiness area. The activity module 142 may further include multipleRNNs, each of which correspond to a separate product or market.

In an embodiment, the recurrent bottleneck autoencoder may use LSTMunits. Each LSTM unit has a cell which has a state at time t. This cellmay represent a memory unit. Access to this memory unit for reading ormodifying it is controlled through sigmoidal gates. LSTM architecture,which uses purpose built memory cells to store information may be usedto exploit long range dependencies in the data.

FIG. 7 depicts a workflow for detecting abnormal activity as may beimplemented with computer devices and computer networks, such as thosedescribed with respect to FIG. 1, 2 , or 3. Embodiments may involve all,more or fewer actions indicated by the blocks of FIG. 7 . The actionsmay be performed in the order or sequence shown or in a differentsequence.

At act A210, a risk processor 324 of an activity module 142 generates aplurality of risk profiles for the participant for a plurality of timeperiods. The plurality of risk profiles may be based on a plurality ofhistorical participant parameters. Each of the risk profiles maycorrespond to a VaR for a portfolio for a participant for a specifictime or time period. VaR may determine a potential for loss for theparticipant being assessed, as well as the probability of occurrence forthe defined loss. VaR is measured by assessing the amount of potentialloss, the probability of occurrence for the amount of loss, and the timeframe. VaR may be calculated for a participant, a firm, an individual,or other entity. VaR may be calculated for different periods of time.

In an embodiment, a risk profile may be generated across one or moreparticipants. For example, one or more participants may generate similarnormal activity. The activity of the similar participants may becombined to generate a more accurate baseline normal risk profile. In anembodiment, a risk profile may be generated for a participant across asingle market or selected group of products. A risk profile, forexample, may only include transactional data for a single product asopposed to a risk profile that may track activity for a participantacross multiple products or markets. In an embodiment, a user may adjusta risk profile to expand or shrink the bounds of expected activity.

At act A220 the risk processor 324 generates, a plurality of externalrisk profiles for the plurality of time periods, the plurality ofexternal risk profiles based on a plurality of historical externalfactors. The external factors may include, but are not limited toproduct volatility, e.g., dispersion of price values, market sentiment,e.g., Volatility (VIX) index, Index Health (+/−), Eventful time (+/−),Aggressing Order Rate, Time to expiration, and Economic/market releases.An external risk profile may represent a credit risk level of theenvironment. The external risk profile may be calculated by weightingone or more of the external factors. The external risk profile may becalculated for a single market or product.

At act A230 the neural network 320 identifies a plurality ofrelationships between the plurality of risk profiles and plurality ofexternal risk profiles using a structured neural network comprising alayered plurality of interconnected processing nodes. Each connection ofthe plurality of interconnected processing nodes to another may bedynamically weighted. The risk processor 324 may include a recurrentneural network 320 that is trained on the plurality of risk profiles andthe plurality of external risk profiles. The neural network 320 may beseparate from the risk processor 324. The recurrent neural network 320may also use the individual parameters or factors as inputs fortraining. The recurrent neural network 320 may be an autoencoderrecurrent neural network. An autoencoder network has two stages: anencoder stage and a decoder stage. During the encoder stage the numberof hidden units decreases at each stage, effectively compressing thedata. During the decoder stage the compressed data is reconstructed. Ifgood compression is achieved at the same time as a good reconstruction,then the compressed representation may be expected to have capturedpatterns in the data.

At act A240 the risk processor 324 receives an electronic datatransaction request message comprising data for a new transaction. Theelectronic data transaction request message may include data such as aprice, product, and quantity.

At act A250 the risk processor 324 calculates a current external factorrisk profile as a function of current external parameters. Similar tothe historic external factor risk profiles, the current external factorrisk profiles may represent a credit risk of the current environment.The current external factor risk profile may be calculated for theentire environment or a subset such as a single product or product type.

At act A260 the risk processor 324 calculates a current risk profile forthe participant comprising at least the data for the new transaction.Similar to the historic risk profile, the current risk profile mayrepresent a VaR for the participant at the time the electronic datatransaction is received. VaR is a measure of the risk of investments.VaR estimates how much a set of investments might lose, given marketconditions, in a set time period.

At act A270 the neural network 320 compares the current risk profile,current external factor risk profile, the plurality of risk profiles,and the plurality of external risk profiles using the plurality ofrelationships. The plurality of relationships may represent a model of anormal risk profile of a participant over a period of time given theexternal factors and external risk profiles. The current risk profileand current external factors may be compared to the baseline normal riskprofiles, generating a comparison. A normal risk profile may be anindication of the normal risk a participant takes over time. Anydeviation or abnormal activity that may result in a loss may generate arisk profile that is deviant or abnormal.

At act A280 the neural network 320 calculates an abnormality score basedon the comparison. An abnormality score may be a quantification of howsimilar the current risk profile, current external factor risk profile,the plurality of risk profiles, and the plurality of external riskprofiles are. In an embodiment, the abnormality score may use a

At act A290 an alert is generated when the abnormality score exceeds athreshold. The alert may be generated by the risk processor 324, anactivity profiler 328, or the neural network 320. The alert may indicatea level of deviation from prior activity by the participant. Differentalerts may be generated depending on the abnormality score. For example,for a 1 to 100 score (lower being more abnormal), a score of 70 or belowmay generate an alert. A score of 50 or below may generate an urgentalert. A score of 30 or below may send a command to the exchange toprohibit the transaction. Different scales or levels of alerts may beused by different participants or in different environments. The alertgenerated may include information regarding the risk profile of theparticipant or the environment.

FIG. 8 depicts a workflow for detecting abnormal behavior as may beimplemented with computer devices and computer networks, such as thosedescribed with respect to FIG. 1, 2 , or 3. Embodiments may involve all,more or fewer actions indicated by the blocks of FIG. 8 . The actionsmay be performed in the order or sequence shown or in a differentsequence.

At act A310 historic participant transaction data and historic externalfactor data is stored in memory. The historic participant transactiondata and the historic external factor data may be linked by time data.For example, when the transaction data is recorded, the external factordata may be recorded or stored as well. In an embodiment, the historicparticipant transaction data may be stored as portfolio data, forexample, in a risk profile of a participant, firm, or other tradingentity. The historic participant transaction data may be stored as thepositions held by the participant, firm, or other trading entity fordifferent time periods. In certain embodiments, the risk module in anexchange may calculate a risk profile for a participant for a pluralityof time periods (e.g. at the end of each day to perform settlement).

At act A320, the activity module 142 identifies one or more patternsbetween the historic participant data and the historic external factordata for a time period. Identifying the patterns may include generatinga model of normal participant activity considering the external factors.In an embodiment, a RNN architecture referred to as a recurrentbottleneck autoencoder is used. The architecture (model) may be trainedusing the historic participant data and the historic external factordata. For training the structure, input data (e.g. parameters) isencoded and then decoded. The trained structure may represent a profileof a participant's market activity during a trading day such thattrading patterns may be compared against the structure and a predictionof credit worthiness or risk created. Autoencoders are a type of RNNthat allows unsupervised learning of patterns within sequences. Once thepatterns have been learned, the patterns may form the input to a searchalgorithm.

An autoencoder learns patterns by first compressing (encoding) the inputdata and then decompressing (decoding) to reconstruct the input data.Data with a high degree of structure (as opposed to random data) mayallow for a higher compression ratio as the compressing encoder mayleverage the structure to reduce the compressed data size. Finding agood compressing encoder essentially means finding structure or patternsin the input data.

The autoencoder neural network has two stages: an encoder stage and adecoder stage. During the encoder stage the number of hidden unitsdecreases at each stage, effectively compressing the data. During thedecoder stage the compressed data is reconstructed. If a goodcompression may be achieved at the same time as a good reconstruction,then the compressed representation to have captured patterns in thedata.

The structure may be trained by end to end backpropagation through theencoder and decoder. The inputs to the structure are encoded as areal-valued X-dimensional vector of participant and environmental factorinput parameters. At each time step, an input is fed through the layersof the encoder, with the hidden states updating based on the most recentinput as well as on the existing hidden state from previous inputs.After the input sequence ends, the hidden state of the last recurrentlayer is used to initialize the hidden state of the first recurrentlayer of the decoder. The state is fed through the decoder layers toproduce the output at the first-time step. The output is fed back intothe input of the next time step of the decoder, making the network aconditional recurrent network. The targets for the decoder correspond tothe reversed input sequence and the error of the network is computed asthe squared distance between output and target.

At act A330, the activity module 142 receives new transaction data andcurrent external factor data. The new transaction data and currentexternal factor data may be received and stored at the exchange. Thecurrent external factor data may be calculated by one or more modules inthe exchange or received from external sources. The new transaction datamay be used to calculate an updated risk profile for a participant.

At act A340, the activity module 142 calculates, using the one or morepatterns, an abnormality score that represents a level of deviationbetween the current transaction data and the historic participanttransaction data. The new transaction data is encoded. The encoded valueis compared against historic encoded data for the same instrument withina search time window. The nearest matches are returned. If the averageof the difference between best matches and the target data set isoutside an acceptable value, then an alert may be generated. The extentof the deviation from the acceptable value may be used to direct actionsvarying from warnings to interruption of trading.

At act A350, the activity module 142 generates an alert when theabnormality score exceeds a threshold. The output from the model may bea probability illustrating how close a match the current trading profileis to historic trading patterns for the firm. If this value is below aspecified threshold, then a potential risk has been detected and analert may be generated.

When applied to a financial exchange computer system, the embodimentsdescribed herein may utilize trade related electronic messages to enacttrading activity in an electronic market. The trading entity and/orparticipant may have one or multiple trading terminals associated withthe session. Furthermore, the financial instruments may be financialderivative products. Derivative products may include futures contracts,options on futures contracts, futures contracts that are functions of orrelated to other futures contracts, swaps, swaptions, or other financialinstruments that have their price related to or derived from anunderlying product, security, commodity, equity, index, or interest rateproduct. In one embodiment, the orders are for options contracts thatbelong to a common option class. Orders may also be for baskets,quadrants, other combinations of financial instruments, etc. The optioncontracts may have a plurality of strike prices and/or comprise put andcall contracts. As used herein, an exchange 100 includes a place orsystem that receives and/or executes orders.

The illustrations of the embodiments described herein are intended toprovide a general understanding of the structure of the variousembodiments. The illustrations are not intended to serve as a completedescription of all of the elements and features of apparatus and systemsthat utilize the structures or methods described herein. Many otherembodiments may be apparent to those of skill in the art upon reviewingthe disclosure. Other embodiments may be utilized and derived from thedisclosure, such that structural and logical substitutions and changesmay be made without departing from the scope of the disclosure.Additionally, the illustrations are merely representational and may notbe drawn to scale. Certain proportions within the illustrations may beexaggerated, while other proportions may be minimized. Accordingly, thedisclosure and the figures are to be regarded as illustrative ratherthan restrictive.

While this specification contains many specifics, these should not beconstrued as limitations on the scope of the invention or of what may beclaimed, but rather as descriptions of features specific to particularembodiments of the invention. Certain features that are described inthis specification in the context of separate embodiments may also beimplemented in combination in a single embodiment. Conversely, variousfeatures that are described in the context of a single embodiment mayalso be implemented in multiple embodiments separately or in anysuitable sub-combination. Moreover, although features may be describedabove as acting in certain combinations and even initially claimed assuch, one or more features from a claimed combination may in some casesbe excised from the combination, and the claimed combination may bedirected to a sub-combination or variation of a sub-combination.

Similarly, while operations are depicted in the drawings and describedherein in a particular order, this should not be understood as requiringthat such operations be performed in the particular order shown or insequential order, or that all illustrated operations be performed, toachieve desirable results. In certain circumstances, multitasking andparallel processing may be advantageous. Moreover, the separation ofvarious system components in the embodiments described above should notbe understood as requiring such separation in all embodiments, and itshould be understood that the described program components and systemsmay generally be integrated together in a single software product orpackaged into multiple software products.

One or more embodiments of the disclosure may be referred to herein,individually and/or collectively, by the term “invention” merely forconvenience and without intending to voluntarily limit the scope of thisapplication to any particular invention or inventive concept. Moreover,although specific embodiments have been illustrated and describedherein, it should be appreciated that any subsequent arrangementdesigned to achieve the same or similar purpose may be substituted forthe specific embodiments shown. This disclosure is intended to cover anyand all subsequent adaptations or variations of various embodiments.Combinations of the above embodiments, and other embodiments notspecifically described herein, will be apparent to those of skill in theart upon reviewing the description.

The Abstract of the Disclosure is provided to comply with 37 C.F.R. §1.72(b) and is submitted with the understanding that it will not be usedto interpret or limit the scope or meaning of the claims. In addition,in the foregoing Detailed Description, various features may be groupedtogether or described in a single embodiment for the purpose ofstreamlining the disclosure. This disclosure is not to be interpreted asreflecting an intention that the claimed embodiments require morefeatures than are expressly recited in each claim. Rather, as thefollowing claims reflect, inventive subject matter may be directed toless than all of the features of any of the disclosed embodiments. Thus,the following claims are incorporated into the Detailed Description,with each claim standing on its own as defining separately claimedsubject matter.

It is therefore intended that the foregoing detailed description beregarded as illustrative rather than limiting, and that it be understoodthat it is the following claims, including all equivalents, that areintended to define the spirit and scope of this invention.

What is claimed is:
 1. A computer implemented method comprising:identifying, by a processor coupled with a data transaction processingsystem, using a structured neural network, one or more patterns inhistoric participant transaction data for a participant in the datatransaction processing system and historic external market factor dataincluding data indicative of characteristics of a financial derivativeproduct traded on an exchange for a time period that corresponds to thehistoric participant transaction data that occurs during the timeperiod, the one or more patterns indicative of a historical normalactivity by the participant in relation to the historic external marketfactor data; receiving, by the processor, from the participant, dataindicative of a new transaction; calculating, by the processor, currentexternal market factor data; comparing, by the processor, the dataindicative of the new transaction and the current external market factordata with the one or more patterns; generating, by the processor, anabnormality score for the new transaction based on the comparison; andgenerating, by the processor, an alert when the abnormality scoreexceeds a first threshold.
 2. The computer implemented method of claim1, wherein the structured neural network comprises a layered pluralityof interconnected processing nodes.
 3. The computer implemented methodof claim 2, wherein at least a subset of connections of the layeredplurality of interconnected processing nodes to another is dynamicallyweighted.
 4. The computer implemented method of claim 2, whereinidentifying the one or more patterns comprises: encoding, by theprocessor, using the structured neural network, the historic participanttransaction data and the historic external market factor data using aplurality of first layers of the layered plurality of interconnectedprocessing nodes; decoding, by the processor, using the structuredneural network, the encoded data using a plurality of second layers ofthe layered plurality of interconnected processing nodes; comparing, bythe processor, using the structured neural network, the decoded datawith the historic participant transaction data and the historic externalmarket factor data; and identifying, by the processor, using thestructured neural network, the one or more patterns in the layeredplurality of interconnected processing nodes when the decoded data iswithin a predefined distance of the historic participant transactiondata and the historic external market factor data.
 5. The computerimplemented method of claim 4, wherein the plurality of first layerscomprise a decreasing number of nodes in each layer of the plurality offirst layers, and the plurality of second layers comprise an increasingnumber of nodes in each layer of the plurality of second layers.
 6. Thecomputer implemented method of claim 4, wherein only outputs of asmallest layer of the plurality of first layers is connected to alargest layer of the plurality of second layers.
 7. The computerimplemented method of claim 2, wherein the layered plurality ofinterconnected processing nodes comprises a plurality of long short termmemory nodes.
 8. The computer implemented method of claim 2, wherein theinterconnected processing nodes comprise long short term memory units.9. The computer implemented method of claim 1, further comprising:updating, by the processor, the historic participant transaction dataand the historic external market factor data with the data indicative ofthe new transaction and the current external market factor data.
 10. Thecomputer implemented method of claim 1, further comprising: prohibiting,by the processor, the new transaction from being processed when theabnormality score exceeds a second threshold.
 11. The computerimplemented method of claim 1, wherein the historic participanttransaction data comprises data relating to a single or related set ofproducts.
 12. A computer implemented method comprising: calculating, bya risk processor, a plurality of risk profiles for a participant in adata transaction processing system for a plurality of time periods, theplurality of risk profiles based on a plurality of historicalparticipant parameters; calculating, by the risk processor, a pluralityof external risk profiles for the plurality of time periods, theplurality of external risk profiles based on a plurality of historicalexternal market parameters including data indicative of characteristicsof a financial derivative product traded on an exchange that correspondto the plurality of historical participant parameters that occurs duringthe plurality of time periods; identifying, by the risk processor usinga structured neural network, a plurality of patterns between theplurality of risk profiles and the plurality of external risk profiles;receiving, by the risk processor, data for a new transaction from theparticipant; calculating, by the risk processor, a current externalfactor risk profile as a function of current external market parameters;generating, by the risk processor, a current risk profile for theparticipant comprising at least data for the new transaction; comparing,by the risk processor, the current risk profile, the current externalfactor risk profile, the plurality of risk profiles, and the pluralityof external risk profiles using the plurality of patterns; calculating,by the risk processor, an abnormality score based on the comparison; andgenerating, by the risk processor, an alert when the abnormality scoreexceeds a threshold.
 13. The computer implemented method of claim 12,wherein calculating the plurality of risk profiles comprises calculatingusing a value at risk factor that indicates a probability of occurrenceof loss by a predefined factor by a predefined amount of time.
 14. Thecomputer implemented method of claim 12, wherein the structured neuralnetwork comprises a layered plurality of interconnected processing nodesand wherein at least a subset of connections of the layered plurality ofinterconnected processing nodes to another is dynamically weighted. 15.The computer implemented method of claim 14, wherein identifying theplurality of patterns comprises: encoding, by the risk processor usingthe structured neural network, the plurality of risk profiles andplurality of external risk profiles using a plurality of first layers ofthe layered plurality of interconnected processing nodes; decoding, bythe risk processor using the structured neural network, the encoded datausing a plurality of second layers of the layered plurality ofinterconnected processing nodes; comparing, by the risk processor usingthe structured neural network, the decoded data with the plurality ofrisk profiles and plurality of external risk profiles; and identifying,by the risk processor using the structured neural network, the pluralityof patterns in the layered plurality of interconnected processing nodeswhen the decoded data is within a predefined distance of the pluralityof risk profiles and the plurality of external risk profiles.
 16. Thecomputer implemented method of claim 15, wherein the plurality of firstlayers comprise a decreasing number of nodes in each layer of theplurality of first layers, and the plurality of second layers comprisean increasing number of nodes in each layer of the plurality of secondlayers.
 17. The computer implemented method of claim 15, wherein thelayered plurality of interconnected processing nodes comprises aplurality of long short term memory nodes.
 18. The computer implementedmethod of claim 12, further comprising: updating, by the risk processorusing the structured neural network, the plurality of patterns using thedata indicative of the new transaction and the current external marketparameters.
 19. A computer system comprising: a processor coupled with adata transaction processing system; a non-transitory computer-readablemedium coupled with the processor, the non-transitory computer-readablemedium storing computer-executable instructions executable by thecomputer system to cause the processor to: identify, using a recurrentneural network autoencoder, one or more patterns in a plurality ofhistoric participant transactions for a participant in the datatransaction processing system and a plurality of historic externalmarket factors including data indicative of characteristics of afinancial derivative product traded on an exchange for a time periodthat corresponds to the plurality of historic participant transactionsthat occur during the time period; receive a new transaction from theparticipant; calculate a plurality of current external market factors;compare the new transaction and the plurality of current external marketfactors with the one or more patterns; generate an abnormality score forthe new transaction based on the comparison; and generate an alert whenthe abnormality score exceeds a first threshold.
 20. The computer systemof claim 19, wherein the recurrent neural network autoencoder comprisesa layered plurality of interconnected processing nodes, wherein at leasta subset of connections of the layered plurality of interconnectedprocessing nodes to another is dynamically weighted.
 21. The computersystem of claim 20, wherein the layered plurality of interconnectedprocessing nodes comprises a plurality of long short term memory nodes.22. The computer system of claim 20, wherein the recurrent neuralnetwork autoencoder is further configured to identify one or moreupdated patterns in the plurality of historic participant transactions,the plurality of historic external market factors, the new transaction,and the plurality of current external market factors.
 23. The computersystem of claim 19, wherein the processor is further configured tocalculate a risk profile for the new transaction and analyze the riskprofile using the one or more patterns.
 24. The computer system of claim23, wherein the risk profile comprises a value at risk factor thatindicates a probability of occurrence of loss by a predefined factor bya predefined amount of time.
 25. A computer system comprising: means foridentifying, using a structured neural network, one or more patterns inhistoric participant transaction data for a participant in a datatransaction processing system and historic external market factor dataincluding data indicative of characteristics of a financial derivativeproduct traded on an exchange for a time period that corresponds to thehistoric participant transaction data that occurs during the timeperiod, the one or more patterns indicative of historical normalactivity by the participant in relation to the historic external marketfactor data; means for receiving from the participant, data indicativeof a new transaction; means for calculating current external marketfactor data; means for comparing the data indicative of the newtransaction and the current external market factor data with the one ormore patterns; means for generating an abnormality score for the newtransaction based on the comparison; and means for generating an alertwhen the abnormality score exceeds a first threshold.